Percolation of secret correlations in a network 
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In this work, we explore the analogy between entanglement and secret classical correlations in 
the context of large networks, more precisely the question of percolation of secret correlations in 
a network. It is known that entanglement percolation in quantum networks can display a highly 
nontrivial behavior depending on the topology of the network and on the presence of entanglement 
between the nodes. Here we show that this behavior, thought to be of a genuine quantum nature, 
also occurs in a classical context. 



In 1993, Maurer introduced an information- 
theoretically secure secret-key agreement scenario 
where two honest parties, Alice and Bob, have access 
to many independent outcomes of random variables 
A^ B correlated with the eavesdropper's (Eve) variable 
E through the probability distribution PA,B,E{ci^b^e). 
Their goal is to extract a secret key from their data with 
the help of; (i) local manipulations of their respective 
variables, using protocols such as error correction codes 
and privacy amplification; (ii) communicating over a 
public channel, i.e., using local operations and public 
communication [l]. 

It was later observed in [2l |3] that Maurer 's scenario 
shares a lot of similitudes with the quantum scenario 
where Alice, Bob and Eve share an initial quantum state 
pABE and Alice and Bob's task is to distill a maximum 
amount of entanglement qubits (ebits), i.e., 
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using local operations and classical communication. In 
the same way as entanglement can be seen as a resource 
that cannot increase under local operations and classical 
communication, secret classical correlations are measured 
in secret bits (sbits), i.e., 



PA,B,E{a,b,e) = -Sa,bPE{e), 



(2) 



a universal resource that cannot increase under local op- 
erations and public communication. In this expression, 
da^b = 1 if a = b and 6a,b = otherwise and Pe{^) 
refers to any possible distribution of Eve's random vari- 
able e, which is therefore completely uncorrelated with 
Alice and Bob's variables. In [2j, it was shown that many 
quantum information processing protocols have an equiv- 
alent protocol in Maurer's secure secret-key scenario. For 
example, the analog of quantum teleportation is simply 
one-time pad, see Figure 1 (b). Similarly, entanglement 
distillation, entanglement dilution, (probabilistic) single- 
copy conversion were also shown to have secure secret- 
key analogous protocols. It is not surprising then that 



entanglement measures, such as the entanglement distil- 
lation and entanglement of formation, have their corre- 
sponding secure secret-key measure [H SI |5]. The con- 
nection between entanglement and secure secret-key has 
benefited the research in both fields. On the first hand, 
Gisin and Wolf asked whether a classical secrecy analog 
of bound entanglement [4J existed. This question was 
positively answered in [6j, where a tripartite (plus Eve) 
distribution PABCE{ci-,b,c,e) was shown to need previ- 
ously established secrecy between the honest parties to 
be generated, but from which no secret key could be dis- 
tilled. Despite further results [7, 8j, it still an open ques- 
tion whether there exists bipartite bound-secrecy while 
bipartite bound-entanglement is known to exist. On the 
other hand, the secrecy measure intrinsic information, 
introduced in [9j and shown to be a lower-bound of the 
secret distillation and an upper-bound of the secret of 
formation in [5j, was generalized to the quantum sce- 
nario in [lOj. There, the authors introduced the squashed 
entanglement measure which has recently received a lot 
of attention [Tn[T2] . 



In this paper, we want to explore the analogy between 
entanglement and secret classical correlations in the con- 
text of large networks. More precisely, we study the per- 
colation of secret correlations in lattices. In the quantum 
case, when the goal is to establish ebits between two ar- 
bitrary nodes of a quantum lattice, there exists a phase 
transition for entanglement percolation for which the suc- 
cess probability does not decrease exponentially with the 
distance between the two nodes [13j. More interestingly, 
Ref. [TSJ gave the first example of a quantum protocol 
that changes the topology of the network, making pos- 
sible the distillation of a perfect entanglement link in 
a regime where traditional percolation would fail. This 
phenomenon was further studied in [T4HT8] and extended 
to the mixed state scenario [T9l-f2T|. In the present work, 
we show that the same phenomenon already happens in 
the purely classical context of Maurer's secret-key agree- 
ment scenario. 



I. SECRET-KEY NETWORKS 

In this work, we study secrecy distribution in secret- 
key networks, see Figjl] (a). More precisely, we are inter- 
ested in secret-key networks where each edge a6, between 
nodes A and B, corresponds to a biased secret-key bit 

PA,B,E{a,b,e) = [(1 -p)Sa,b,o +P^a,6,i] *^£;(e) (3) 

where Sa,b,x '= ^ab^ax and p < 1/2. 




Figure 1: (Color online.) Secret-key networks: a) A general 
secret-key network is composed of a set of nodes (vertices of 
the graph) distributed with a given geometry, sharing secrecy 
correlations when connected by a link (edges of the graph), 
b) One-time Pad: In order to establish a unbiased secret bit 
between, previously unconnected, nodes A and C, B and C 
apply one round of one-time pad; (i) B publicly announces 
the value of z = &i © ^2; (ii) C calculates c = c ^ z which 
gives c' = a. 



probability I — p > 1/2), Alice tosses a biased coin that 
gives "heads" with probability {l — 2p)/{l—p). If she gets 
"heads", she tells Bob to abort the protocol; otherwise, 
they keep a as the final sbit. It is easy to check that 
conditioned on the fact that the protocol did not abort, 
the value of a is unbiased. 

A chain with 2 links: consider the scenario shown in 
Fig. [1] (b) with three nodes where A and B share a bi- 
ased secret bit (a = hi) while B and C share a second 
biased secret bit 62 = c. The probability of establish- 
ing a unbiased bit between nodes A and C can only be 
lower or equal to the probability of conversion of a sin- 
gle link. Surprisingly, there exists a strategy succeeding 
with average probability 2p. This strategy uses one-time 
pad, the secret-key protocol analogous to quantum tele- 
portation: node B simply publicly announces the value 
of 61 62- If ^1 ^2 = 1, which happens with probability 
2p{l —p)^C flips his bit and obtains an unbiased secret 
bit shared with A. If 61 62 = 0, A and C secret-key 
(unnormalized) distribution becomes 

PA,C,E{a, C, e) OC [(1 - p)^(5a,c,0 + P^^a,c,l] * PE{e), (4) 

which has a conversion probability Pc 



Putting everything together gives an average probabil- 
ity of success of 



P{bi 62 = 1) * 1 + P{bi 
2p{l-p)^2p^ =2p. 



0) * Pc 



(5) 



Two parallel links: if the nodes A and B share two 
biased secret bits ai and a2 (with p < 1 — 1/a/2), the 
optimal probabilistic conversion strategy (see Theorem 2 
of Appendix 1) consists for nodes A and B in mapping 
their two bits into a new bit aj such that a/ = if 
ai = a2 = and a/ = 1 otherwise. The bit a/ then 
follows a Bernoulli distribution with parameter (1 — p)^ 
and the probability to convert it into an unbiased secret 
bit is 2(1 - (1 - p)2) = 2p{2 - p). 



The question we want to address is the following: given 
a secret-key network and a choice of two nodes, does there 
exist a strategy, based on local manipulations of the bits 
and public classical communication, allowing to distill a 
secret bit (sbit) between these two nodes? Let us first 
start by considering some simple examples of networks 
as their analysis will be useful for the rest of the paper. 



A. Simple examples 

A single link: The simplest network consists of two 
nodes, A and 5, sharing a biased secret bit following a 
Bernoulli distribution of parameter p <l/2 given by Eq. 
pi). The results for probabilistic conversion of [2j (see 
Appendix [T]) show that the probability to convert this 
biased secret bit into an unbiased one is equal to 2p. A 
protocol achieving this optimal value is the following. Let 
a be Alice and Bob's bit. If a = (which happens with 



B. The straightforward strategy 

As in the quantum scenario [13j, there exists one natu- 
ral strategy to distill an unbiased secret bit between two 
arbitrary nodes, A and 5, of a given lattice L. This pro- 
tocol consists in trying to convert each biased secret bit 
(corresponding to each edge of the lattice) into an un- 
biased secret bit, each conversion succeeding with some 
probability Psucc- If there exists a path among the edges 
of the unbiased secret bit graph connecting nodes A and 
5, then, using one-time pad along this path, one can 
produce a secret bit between nodes A and B. Based 
on percolation theory, one can show that the probabil- 
ity that two arbitrary nodes are connected by a path 
does not depend on their distance in the graph if Psucc is 
larger than the critical percolation threshold probability 
p^ of the lattice. For Psucc ^ P^ the success probabil- 
ity of the overall procedure decreases exponentially with 



the distance in the lattice between the two nodes (see 
Appendix [2] for details). The question that one wishes 
to answer is whether or not this simple strategy is opti- 
mal and whether the bound corresponding to p^ is tight. 
In the case of entanglement percolation, it was shown in 
[13j that the strategy described above is asymptotically 
optimal in the case of one-dimensional chains but not in 
general for two-dimensional lattices. In the following, we 
show that these two statements also apply to the case of 
secret classical correlations. 



II. ONE-DIMENSIONAL CHAIN 

A. Presentation of the problem 

Let us consider a one-dimensional chain with n links 
and n + 1 nodes: Aq, Ai, • • • , A^. Each link i corresponds 
to a pair of biased perfectly correlated variables, as in 
Eq.([3|. Because each pair is perfectly correlated, we sim- 
plify the discussion by noting a^ the single bit shared by 
Ai-i and A^, as shown in Fig. [2] In this model, the eaves- 




Nod© a. ! \ Node A3 : 



SI 



X^yOptimal Probabilistic Conversion 



Node A3 j 
• 1- 



sbit 



Figure 2: (Color online.) ID-chain (4 nodes in the figure): 
The protocol giving the best probability of distilling a secret 
bit between nodes Aq and An works as follows: (i) Each in- 
termediate node, Ai {1 < i < n — 1), makes public the value 
of the sum (modulo 2) of its two bits: z* = a^ a^+i; (ii) 
Node An calculates privatly CLn®Y17^i ^^5 (^^^) Nodes Aq and 
An apply the optimal probabilistic conversion protocol for the 
given set (zi, ..., z^-i). 

dropper has no prior information on the bits a^ (except 
for the value of p), meaning that her initial probability 
distribution is uncorrelated with (ai,--- ,an). We will 
now show that the probability of establishing a perfect 
secret bit between the extremities of a chain, (between 
Aq and An) decreases exponentially fast with n, except 
if the chain is initially composed of perfect secret bits, 
i.e., if p = 1/2. Hence, with that respect, distribution 



of secrecy and distribution of entanglement display the 
same behavior in the case of one-dimensional chains. 



B. Description of the optimal protocol 

Let us first start with the smallest, but non-trivial, 
case of 2 links. The general proof will then follow by 
induction. As shown on Fig. |2| nodes Aq and Ai share 
the biased secret bit ai and nodes Ai and A2 share a2. 
Both bits, ai and a2, are biased and have value with 
probability 1—p. The goal is for Aq and A2 is to distill a 
secret bit unknown to Eve, who had no prior information 
on ai and a2. 

In order to succeed, node Ai has to publicly announce 
some information, zi, depending on his own bits ai and 
a2 and possibly on some random ancillary bits. This 
public information should allow nodes Aq and A2 to 
distill a secret bit, without giving any information to 
Eve. In full generality, node Ai may use a probabilistic 
strategy to generate Zi. However, because every proba- 
bilistic strategy is a convex combination of deterministic 
ones, a probabilistic strategy cannot be better than the 
best deterministic one. Therefore, it is sufficient to con- 
sider the set of deterministic functions zi = /(ai,a2). 
Since Ai simply needs to tell node A2 whether it should 
keep its bit a2 or flip it in order to match the secret 
bit ai, zi only needs to take 2 possible values, or 
1. As a consequence, we only need to analyse 16 pos- 
sible functions / of ai and a2. The constraints of the 
problem help us find the only possibility for /. First, 
node A2 should be able to recover ai from the knowl- 
edge of a2 and zi, imposing /(0,a2) ^ /(l,a2). Second, 
Eve should not learn any information about ai, impos- 
iiig Ea2 /(0'^2) = Ea2 /(l'^2). Up to a relabeling, the 
only function that satisfies these constraints is the exclu- 
sive or (XOR): /(ai,a2) = ai a2. It is not surprising 
that we obtain exactly the one-time pad protocol, which 
achieves a success probability of 2p for a three node chain, 
as shown before. 

Generalization to n links: In a scenario with more 
links, it is easy to see that the same reasoning ap- 
plies. In particular, all the intermediate nodes should 
announce the XOR of their two bits, up to some relabel- 
ing. The protocol is therefore the following. Each inter- 
mediate node Ai (for 1 < i < n — 1) publicly announces 
Zi = ai ® <^i+i. The final node can then compute the 
value of ai since ai = a^ Zn-i Zn-2 • • • ^i- Once 
nodes Aq and An share this (biased) secret bit, they can 
proceed with the optimal probabilistic conversion proto- 
col of Theorem [2] and end up with a unbiased secret bit. 
The average success probability reads 



P7 



= ^ p{zi, • • • , Zn-l)p{sUCCeSs\zi, • • • , Zn-l) 



(6) 
where p(success|zi, • • • , Zn-i) corresponds to the success 
probability of conversion of the bit given that the vector 



announced by the intermediate nodes is (^i,--- ,^n-i)- 
The success probabihty is equal to (twice) the first half 
of the binomial expansion (see Appendix [s]) : 






(7) 



first half 



which can be lower bounded, as shown in the Appendix 
[Iby 



r>„ < (2Vp(i-p)r. 



(8) 



Despite doing better than the straighforward strategy, 
which gives a success probability of (2p)"^, it still de- 
creases exponentially fast with n for initial unbiased se- 
cret bit (p 7^ 1/2), similarly as in the quantum scenario 
[13j. This result is not surprising as for percolation to 
occur, it is crucial that the topology of the network al- 
lows for many different paths between two given nodes to 
exist, which is not possible in a one-dimensional chain. 



III. TWO-DIMENSIONAL CASE 

A possible strategy to distill a secret-key between ar- 
bitrary nodes of a lattice consists in using the straight- 
forward strategy presented in Section [TB) First, one tries 
to distill a secret bit over each link in the lattice. If the 
probability of success is above the percolation threshold 
of the lattice, then with a positive probability, this pro- 
cedure created a path consisting of secret bits between 
the two arbitrary nodes. This path can then be used to 
establish a secret bit between these two nodes thanks to 
one-time pad. 

Following Ref.[13j, we now give an explicit example 
of a 2-dimensional lattice where local preprocessing and 
public communication allows one to change the topology 
of the initial lattice into another one with a lower perco- 
lation threshold. This shows that there exist non-trivial 
strategies that succeed to establish a secret bit between 
two nodes when the naive strategy would fail. The pro- 
tocol involves three basic operations that were described 
in Section [l| (i) the conversion of a single link into an 
sbit with success probability pi = 2p; (ii) the conversion 
of two consecutive links into an sbit, also with success 
probability ^2 = 2j9; (iii) the conversion of two parallel 
links, with success probability p// = 2p(2 — p). 

Let us consider an initial honeycomb (hexagonal) lat- 
tice, as shown in Figure [3J where each link of the lattice 
consists of 2 biased secret-key bits with parameter p. For 



this lattice, the naive strategy of Section |IB| succeeds 
with constant probability as soon as p// > p^®^, where 
the percolation threshold probability for the honeycomb 
lattice is given by 



P, 



hex 



1 - sin(27r/18) « 0.6527. 



(9) 



Therefore, the straightforward percolation strategy suc- 
ceeds only for p > 0.1792. 




Figure 3: (Color online.) The initial configuration is a hon- 
eycomb (hexagonal) lattice, each node being represented by 
a circle. Each two adj accent nodes are connected by two 
links, each one representing a biased secret-key bit. Using 
local operations and public communication, we can tranform 
the topology to a triangular lattice improving the percolation 
threshold. To do so, every yellow node performs three parallel 
one-time pad operations, one for each pair of connected links 
(labeled by a star in the interior of the brown node). This 
tranforms every pair of connected links into a link of the new 
triangular lattice (see black stars for those corresponding to 
the brown node). 



As illustrated in Ref. p^, one might consider a more 
elaborate strategy, namely, one can try to change the 
topology of the lattice in order to facilitate percolation. 
As shown in Figure 3, the idea is that half the nodes from 
the original lattice should work together in order to create 
a triangular lattice. To do that, these nodes perform one- 
time pad over each pair of connected biased secret-key 
bits. It is easy to see that each link of the triangular 
lattice will be distilled into an sbit with probability p2 = 
2p. Percolation can then occur as soon as p2 exceeds the 
threshold percolation probability of the triangular lattice. 



P, 



triang 



sin(27r/18) « 0.3473. 



(10) 



This "topology conversion" strategy is therefore compati- 
ble with percolation of sbits for p > 0.1736. We conclude 
that in the regime where p G [0.1736,0.1792], percola- 
tion can occur if the nodes use the non-trivial percola- 
tion strategy consisting in changing the topology of the 
lattice from honeycomb to triangular, while the straight- 
forward strategy fails. Other quantum percolation exam- 
ples [14, 15j can also been easily adapted to the secet-key 
percolation scenario, using the tools presented here. 



IV. CONCLUSION 

In this paper, using known analogies between entangle- 
ment and classical secret-key correlations, we have stud- 
ied secrecy percolation in networks. More precisely, we 
have shown that local operations and public communi- 
cation can be used to change the topology of a secrecy 
network and to establish a secret key between nodes, in a 



regime where the initial lattice configuration is not com- 
patible with percolation of secrecy. This effect was al- 
ready known to exist in quantum entanglement networks. 
Our work shows that this phenomenon thought to be of a 
genuine quantum nature, already appears in the context 
of classical secret correlations. 
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Appendix 

1. Pure State Conversions 

In Ref. [2j , the authors characterized the set of trans- 
formations which are allowed among probability distribu- 
tions. Their characterization is reminiscent of the quan- 
tum case [22j and uses the same notion of majorization. 



2. Bond-percolation in Lattices 

The percolation behaviors that appear in the context 
of quantum networks or secrecy networks are closely re- 
lated to the concept of bond-percolation. The scenario 
of bond-percolation is the following. Consider a lattice L 
such that for each edge of L, the bond is open (or equiv- 
alently, the edge is present) with probability p. Taking 
the limit where the size of L is infinite, one can define the 
probability 0{p) that a randomly chosen node belongs to 
a cluster of infinite size. Then, there exists a critical 
percolation probability p^ such that: 

• 0{p) >Oifp>p^, 

• 0{p) =Oifp<p^. 

The link to our problem is immediate. Given two arbi- 
trary nodes of the lattice, one is interested in whether an 
unbiased secret bit can be established between them. In 
the case where there exists an infinite size component, 
then both nodes belong to this cluster with probability 
0'^{p) and an unbiased secret bit can be established be- 
tween them. Otherwise, if there is no cluster of infinite 
size, the probability of establishing an unbiased secret 
bit decreases exponentially with the distance between the 
nodes in the lattice L. 



Theorem 1 (Deterministic conversion [2j). If Alice and 
Bob begin with an arbitrary classical bipartite pure state, 
PABE^hJi k) = SijPiPE{k), then they can produce a new 
state P'j^^^ii^j^k) = SijqiPE{k) if and only if q ma- 
jorizes p. 

Recall that the vector q = {qi} is said to majorize the 
vector p= {pi} (with pi > P2 ^ - ■ - and qi > q2 ^ ■ - •) 
if 



'^Qi^'^Pi VA;. 



(11) 



i=l 



Whereas Theorem [T] is only concerned with conversion 
strategies which work with probability 1, the following 
result deals with strategies which work with a finite prob- 
ability. Note that again, one recovers the same result as 
in the quantum case [23j. 

Theorem 2 (Probabilistic conversion [2j). If Alice and 
Bob begin with an arbitrary classical bipartite pure state, 
PABE{hJik) = SijPiPE{k), then the maximal probability 
with which they can produce a new state P^^^{i,j^ k) = 
^ijQiPEik) is given by 



1 
min — 

k 1 



Ek 
i=iPi 

Ek 



(12) 



3. Analysis of the protocol of Section |IIB| 

Let us consider the same scenario of a chain of n links 
where each link is a biased secret bit that takes value 1 
with probability p < 1/2, and bound the probability of 
creating a secret bit between the extremities. 

As we saw in Section II B[ the protocol consists first in 
publicly announcing the vector z = (2^1, •• • ,Zn_i), and 
then conditionally on the value of z, try to convert the 
bit shared by Aq and An into an sbit. The probability of 
success Pn of this procedure is therefore given by: 



Pn 



^ p{zi, • • • , 2;n-i)p(success|2:i, • • • , Zn- 



Zi,--- ,Zn-l 



(13) 

where p(success|zi, • • • , Zn-i) corresponds to the success 
probability of conversion of the bit given that the vector 
announced by the intermediate nodes is (^1, • • • , Zn-i)- 

The probability that the public communication is de- 
scribed by z = (zi, • • • , Zn-i) is 

p{z) = p{ai = 0, a2 = 2^1, • • • ,an = ^Zk)^ 

k 

p{ai = 1, a2 = 1 © ^1, • • • ,an = l^Zk) 

k 

Given a particular value of z, the success probability 



for the probabilistic conversion of Theorem [2] reads: 

p(success|z) = 
min(p(ai = 0, • • • ,an = ®Zk),p{ai = !,••• ,CLn = 10 ^fc)) 
p{ai = 0, • • • ,an = ®f,Zk)^ p{ai = 1, • • • , a^ = 1 2;/e) 

Putting everything together, one has 
Pn = 2^min(p(ai,--- ,an),p(al, ••• ,a^)) 

a 
a 



first half 



2 E (ly-'a-p)' 



where a = (ai, • • • ,an), a^ := 1 a/e, w{3.) denotes the 
Hamming weight of the vector a and "first half" means 
that the sum contains exactly the first half of the bi- 
nomial expansion, that is, the 2^~^ first terms of this 
expansion. 



This probability is achieved if all the intermediate 
nodes (n — 1 such nodes) reveal the value of the XOR of 
their two bits. 

This success probability is equal to (twice) the first half 
of the binomial expansion. Let us bound this quantity: 



= 


2 L U ^ (1-^) 


(14) 




first half ^ '^ 




< 


2pL-/2J(l_p)rn/2l y- 'A 
first half ^ ^ 


(15) 


< 


pLn/2J(l_p)rn/2iy^^-^ 


(16) 


< 


2>L»/2J(l_p)rn/21 


(17) 


< 


{2^p{i-p)r, 


(18) 



which goes down to exponentially fast with n for p 7^ 

1/2. 
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